topic Re: Eval and rex to props.comf in Getting Data In

Eval and rex to props.comf

Splunk_rocks — Tue, 29 Sep 2020 19:20:10 GMT

Just looking some help to construct props file for below search statement.

| rex max_match=10 field=violation_details "(?[^<]+)" | base64 field=cookie_value action=decode |

Re: Eval and rex to props.comf

Splunk_rocks — Tue, 29 Sep 2020 19:20:13 GMT

| rex max_match=10 field=violation_details "(?[^<]+)" | base64 field=cookie_value action=decode |

Re: Eval and rex to props.comf

Splunk_rocks — Wed, 02 May 2018 14:22:56 GMT

missing filed info so pasted here ..Looks like field=violation_details ""(?)

Re: Eval and rex to props.comf

FrankVl — Wed, 02 May 2018 14:24:31 GMT

put your search code in as code (use the 101010 button, or surround with ```).

Re: Eval and rex to props.comf

cpetterborg — Wed, 02 May 2018 15:12:26 GMT

Are you trying to get the base64 encoded field decoded through the props.confconfiguration? If so, this can't be done, there is no method of doing the decoding within the props.conf file. You can extract the field, but it will be in the encoded state, not decoded.

Re: Eval and rex to props.comf

mhoogcarspel_sp — Wed, 02 May 2018 15:20:28 GMT

The rex part you can do with a REPORT and a MV_ADD = true in the transforms I think, however the base64 command is another question, as you can't call commands in props/transforms.

I think you would either have to still have the base64 in your search, or thinking outside of the box a bit:
You could implement a base64 lookup as an external script lookup, although I don't know what the limits are of the size that you can input (i.e. this probably won't work for big base64 blobs)

Re: Eval and rex to props.comf

Splunk_rocks — Wed, 02 May 2018 15:21:35 GMT

Thanks for the update, thats what i feel but just thought of double check